WORKERS AHEAD!
You are viewing the development documentation for the Apereo CAS server. The functionality presented here is not officially released yet. This is a work in progress and will be continually updated as development moves forward. You are most encouraged to test the changes presented.
To view the documentation for a specific Apereo CAS server release, please choose an appropriate version. The release schedule is available here.Clustered Deployments
CAS uses the Spring Cloud Bus to manage configuration in a distributed deployment. Spring Cloud Bus links nodes of a distributed system with a lightweight message broker. This can then be used to broadcast state changes (e.g. configuration changes) or other management instructions.
The bus supports sending messages to all nodes listening. Broadcasted events will attempt to update, refresh and reload each CAS server application’s configuration.
If CAS nodes are not sharing a central location for configuration properties such that each node contains a copy of the settings, any changes you make to one node must be replicated and synced across all nodes so they are persisted on disk. The broadcast mechanism noted above only applies changes to the runtime and the running CAS instance. Ideally, you should be keeping track of CAS settings in a shared (git) repository (or better yet, inside a private Github repository perhaps) where you make a change in one place and it’s broadcasted to all nodes. This model removes the need for synchronizing changes across disks and CAS nodes.CAS uses the Spring Cloud Bus to manage configuration in a distributed deployment. Spring Cloud Bus links nodes of a distributed system with a lightweight message broker.
The following settings and properties are available from the CAS configuration catalog:
spring.cloud.bus.ack.destination-service=
Service that wants to listen to acks. By default null (meaning all services). |
spring.cloud.bus.ack.enabled=true
Flag to switch off acks (default on). |
spring.cloud.bus.content-type=
The bus mime-type. |
spring.cloud.bus.destination=
Name of Spring Cloud Stream destination for messages. |
spring.cloud.bus.enabled=true
Flag to indicate that the bus is enabled. |
spring.cloud.bus.env.enabled=true
Flag to switch off environment change events (default on). |
spring.cloud.bus.id=application
The identifier for this application instance. |
spring.cloud.bus.refresh.enabled=true
Flag to switch off refresh events (default on). |
spring.cloud.bus.trace.enabled=false
Flag to switch on tracing of acks (default off). |
Configuration Metadata
The collection of configuration properties listed in this section are automatically generated from the CAS source and components that contain the actual field definitions, types, descriptions, modules, etc. This metadata may not always be 100% accurate, or could be lacking details and sufficient explanations.
Be Selective
This section is meant as a guide only. Do NOT copy/paste the entire collection of settings into your CAS configuration; rather pick only the properties that you need. Do NOT enable settings unless you are certain of their purpose and do NOT copy settings into your configuration only to keep them as reference. All these ideas lead to upgrade headaches, maintenance nightmares and premature aging.
YAGNI
Note that for nearly ALL use cases, declaring and configuring properties listed here is sufficient. You should NOT have to explicitly massage a CAS XML/Java/etc configuration file to design an authentication handler, create attribute release policies, etc. CAS at runtime will auto-configure all required changes for you. If you are unsure about the meaning of a given CAS setting, do NOT turn it on without hesitation. Review the codebase or better yet, ask questions to clarify the intended behavior.
Naming Convention
Property names can be specified in very relaxed terms. For instance cas.someProperty, cas.some-property, cas.some_property are all valid names. While all forms are accepted by CAS, there are certain components (in CAS and other frameworks used) whose activation at runtime is conditional on a property value, where this property is required to have been specified in CAS configuration using kebab case. This is both true for properties that are owned by CAS as well as those that might be presented to the system via an external library or framework such as Spring Boot, etc. When possible, properties should be stored in
lower-case kebab format, such as cas.property-name=value.S ettings and properties that are controlled by the CAS platform directly always begin with the prefix cas. All other settings are controlled and provided to CAS via other underlying frameworks and may have their own schemas and syntax. BE CAREFUL with the distinction. Unrecognized properties are rejected by CAS and/or frameworks upon which CAS depends. This means if you somehow misspell a property definition or fail to adhere to the dot-notation syntax and such, your setting is entirely refused by CAS and likely the feature it controls will never be activated in the way you intend.
Validation
Configuration properties are automatically validated on CAS startup to report issues with configuration binding, specially if defined CAS settings cannot be recognized or validated by the configuration schema. The validation process is on by default and can be skipped on startup using a special system property SKIP_CONFIG_VALIDATION that should be set to true. Additional validation processes are also handled via Configuration Metadata and property migrations applied automatically on startup by Spring Boot and family.
Indexed Settings
CAS settings able to accept multiple values are typically documented with an index, such as cas.some.setting[0]=value. The index [0] is meant to be incremented by the adopter to allow for distinct multiple configuration blocks.
The following endpoints are provided by Spring Cloud:
The transport mechanism for the bus to broadcast events is handled via one of the following components.
Troubleshooting
To enable additional logging, modify the logging configuration file to add the following:
1
2
3
4
<Logger name="org.springframework.amqp" level="debug" additivity="false">
<AppenderRef ref="console"/>
<AppenderRef ref="file"/>
</Logger>
RabbitMQ
This is the default option for broadcasting change events to CAS nodes. RabbitMQ is open source message broker software (sometimes called message-oriented middleware) that implements the Advanced Message Queuing Protocol (AMQP).
Support is enabled by including the following dependency in the final overlay:
1
2
3
4
5
<dependency>
<groupId>org.apereo.cas</groupId>
<artifactId>cas-server-support-configuration-cloud-amqp</artifactId>
<version>${cas.version}</version>
</dependency>
1
implementation "org.apereo.cas:cas-server-support-configuration-cloud-amqp:${project.'cas.version'}"
1
2
3
4
5
6
7
8
9
dependencyManagement {
imports {
mavenBom "org.apereo.cas:cas-server-support-bom:${project.'cas.version'}"
}
}
dependencies {
implementation "org.apereo.cas:cas-server-support-configuration-cloud-amqp"
}
The following settings and properties are available from the CAS configuration catalog:
spring.rabbitmq.address-shuffle-mode=none
Mode used to shuffle configured addresses. |
spring.rabbitmq.addresses=
Comma-separated list of addresses to which the client should connect. When set, the host and port are ignored. |
spring.rabbitmq.cache.channel.checkout-timeout=
Duration to wait to obtain a channel if the cache size has been reached. If 0, always create a new channel. |
spring.rabbitmq.cache.channel.size=
Number of channels to retain in the cache. When "check-timeout" > 0, max channels per connection. |
spring.rabbitmq.cache.connection.mode=channel
Connection factory cache mode. |
spring.rabbitmq.cache.connection.size=
Number of connections to cache. Only applies when mode is CONNECTION. |
spring.rabbitmq.channel-rpc-timeout=10m
Continuation timeout for RPC calls in channels. Set it to zero to wait forever. |
spring.rabbitmq.connection-timeout=
Connection timeout. Set it to zero to wait forever. |
spring.rabbitmq.dynamic=true
Whether to create an AmqpAdmin bean. |
spring.rabbitmq.host=localhost
RabbitMQ host. Ignored if an address is set. |
spring.rabbitmq.listener.direct.acknowledge-mode=
Acknowledge mode of container. |
spring.rabbitmq.listener.direct.auto-startup=true
Whether to start the container automatically on startup. |
spring.rabbitmq.listener.direct.consumers-per-queue=
Number of consumers per queue. |
spring.rabbitmq.listener.direct.de-batching-enabled=true
Whether the container should present batched messages as discrete messages or call the listener with the batch. |
spring.rabbitmq.listener.direct.default-requeue-rejected=
Whether rejected deliveries are re-queued by default. |
spring.rabbitmq.listener.direct.idle-event-interval=
How often idle container events should be published. |
spring.rabbitmq.listener.direct.missing-queues-fatal=false
Whether to fail if the queues declared by the container are not available on the broker. |
spring.rabbitmq.listener.direct.prefetch=
Maximum number of unacknowledged messages that can be outstanding at each consumer. |
spring.rabbitmq.listener.direct.retry.enabled=false
Whether publishing retries are enabled. |
spring.rabbitmq.listener.direct.retry.initial-interval=1000ms
Duration between the first and second attempt to deliver a message. |
spring.rabbitmq.listener.direct.retry.max-attempts=3
Maximum number of attempts to deliver a message. |
spring.rabbitmq.listener.direct.retry.max-interval=10000ms
Maximum duration between attempts. |
spring.rabbitmq.listener.direct.retry.multiplier=1
Multiplier to apply to the previous retry interval. |
spring.rabbitmq.listener.direct.retry.stateless=true
Whether retries are stateless or stateful. |
spring.rabbitmq.listener.simple.acknowledge-mode=
Acknowledge mode of container. |
spring.rabbitmq.listener.simple.auto-startup=true
Whether to start the container automatically on startup. |
spring.rabbitmq.listener.simple.batch-size=
Batch size, expressed as the number of physical messages, to be used by the container. |
spring.rabbitmq.listener.simple.concurrency=
Minimum number of listener invoker threads. |
spring.rabbitmq.listener.simple.consumer-batch-enabled=false
Whether the container creates a batch of messages based on the 'receive-timeout' and 'batch-size'. Coerces 'de-batching-enabled' to true to include the contents of a producer created batch in the batch as discrete records. |
spring.rabbitmq.listener.simple.de-batching-enabled=true
Whether the container should present batched messages as discrete messages or call the listener with the batch. |
spring.rabbitmq.listener.simple.default-requeue-rejected=
Whether rejected deliveries are re-queued by default. |
spring.rabbitmq.listener.simple.idle-event-interval=
How often idle container events should be published. |
spring.rabbitmq.listener.simple.max-concurrency=
Maximum number of listener invoker threads. |
spring.rabbitmq.listener.simple.missing-queues-fatal=true
Whether to fail if the queues declared by the container are not available on the broker and/or whether to stop the container if one or more queues are deleted at runtime. |
spring.rabbitmq.listener.simple.prefetch=
Maximum number of unacknowledged messages that can be outstanding at each consumer. |
spring.rabbitmq.listener.simple.retry.enabled=false
Whether publishing retries are enabled. |
spring.rabbitmq.listener.simple.retry.initial-interval=1000ms
Duration between the first and second attempt to deliver a message. |
spring.rabbitmq.listener.simple.retry.max-attempts=3
Maximum number of attempts to deliver a message. |
spring.rabbitmq.listener.simple.retry.max-interval=10000ms
Maximum duration between attempts. |
spring.rabbitmq.listener.simple.retry.multiplier=1
Multiplier to apply to the previous retry interval. |
spring.rabbitmq.listener.simple.retry.stateless=true
Whether retries are stateless or stateful. |
spring.rabbitmq.listener.simple.transaction-size=
Deprecation status is |
spring.rabbitmq.listener.stream.auto-startup=true
Whether to start the container automatically on startup. |
spring.rabbitmq.listener.stream.native-listener=false
Whether the container will support listeners that consume native stream messages instead of Spring AMQP messages. |
spring.rabbitmq.listener.type=simple
Listener container type. |
spring.rabbitmq.password=guest
Login to authenticate against the broker. |
spring.rabbitmq.port=
RabbitMQ port. Ignored if an address is set. Default to 5672, or 5671 if SSL is enabled. |
spring.rabbitmq.publisher-confirm-type=
Type of publisher confirms to use. |
spring.rabbitmq.publisher-confirms=
Deprecation status is |
spring.rabbitmq.publisher-returns=false
Whether to enable publisher returns. |
spring.rabbitmq.requested-channel-max=2047
Number of channels per connection requested by the client. Use 0 for unlimited. |
spring.rabbitmq.requested-heartbeat=
Requested heartbeat timeout; zero for none. If a duration suffix is not specified, seconds will be used. |
spring.rabbitmq.ssl.algorithm=
SSL algorithm to use. By default, configured by the Rabbit client library. |
spring.rabbitmq.ssl.enabled=
Whether to enable SSL support. Determined automatically if an address is provided with the protocol (amqp:// vs. amqps://). |
spring.rabbitmq.ssl.key-store=
Path to the key store that holds the SSL certificate. |
spring.rabbitmq.ssl.key-store-algorithm=SunX509
Key store algorithm. |
spring.rabbitmq.ssl.key-store-password=
Password used to access the key store. |
spring.rabbitmq.ssl.key-store-type=PKCS12
Key store type. |
spring.rabbitmq.ssl.trust-store=
Trust store that holds SSL certificates. |
spring.rabbitmq.ssl.trust-store-algorithm=SunX509
Trust store algorithm. |
spring.rabbitmq.ssl.trust-store-password=
Password used to access the trust store. |
spring.rabbitmq.ssl.trust-store-type=JKS
Trust store type. |
spring.rabbitmq.ssl.validate-server-certificate=true
Whether to enable server side certificate validation. |
spring.rabbitmq.ssl.verify-hostname=true
Whether to enable hostname verification. |
spring.rabbitmq.stream.host=localhost
Host of a RabbitMQ instance with the Stream plugin enabled. |
spring.rabbitmq.stream.password=
Login password to authenticate to the broker. When not set spring.rabbitmq.password is used. |
spring.rabbitmq.stream.port=
Stream port of a RabbitMQ instance with the Stream plugin enabled. |
spring.rabbitmq.stream.username=
Login user to authenticate to the broker. When not set, spring.rabbitmq.username is used. |
spring.rabbitmq.template.default-receive-queue=
Name of the default queue to receive messages from when none is specified explicitly. |
spring.rabbitmq.template.exchange=
Name of the default exchange to use for send operations. |
spring.rabbitmq.template.mandatory=
Whether to enable mandatory messages. |
spring.rabbitmq.template.queue=
Deprecation status is |
spring.rabbitmq.template.receive-timeout=
Timeout for receive() operations. |
spring.rabbitmq.template.reply-timeout=
Timeout for sendAndReceive() operations. |
spring.rabbitmq.template.retry.enabled=false
Whether publishing retries are enabled. |
spring.rabbitmq.template.retry.initial-interval=1000ms
Duration between the first and second attempt to deliver a message. |
spring.rabbitmq.template.retry.max-attempts=3
Maximum number of attempts to deliver a message. |
spring.rabbitmq.template.retry.max-interval=10000ms
Maximum duration between attempts. |
spring.rabbitmq.template.retry.multiplier=1
Multiplier to apply to the previous retry interval. |
spring.rabbitmq.template.routing-key=
Value of a default routing key to use for send operations. |
spring.rabbitmq.username=guest
Login user to authenticate to the broker. |
spring.rabbitmq.virtual-host=
Virtual host to use when connecting to the broker. |
Configuration Metadata
The collection of configuration properties listed in this section are automatically generated from the CAS source and components that contain the actual field definitions, types, descriptions, modules, etc. This metadata may not always be 100% accurate, or could be lacking details and sufficient explanations.
Be Selective
This section is meant as a guide only. Do NOT copy/paste the entire collection of settings into your CAS configuration; rather pick only the properties that you need. Do NOT enable settings unless you are certain of their purpose and do NOT copy settings into your configuration only to keep them as reference. All these ideas lead to upgrade headaches, maintenance nightmares and premature aging.
YAGNI
Note that for nearly ALL use cases, declaring and configuring properties listed here is sufficient. You should NOT have to explicitly massage a CAS XML/Java/etc configuration file to design an authentication handler, create attribute release policies, etc. CAS at runtime will auto-configure all required changes for you. If you are unsure about the meaning of a given CAS setting, do NOT turn it on without hesitation. Review the codebase or better yet, ask questions to clarify the intended behavior.
Naming Convention
Property names can be specified in very relaxed terms. For instance cas.someProperty, cas.some-property, cas.some_property are all valid names. While all forms are accepted by CAS, there are certain components (in CAS and other frameworks used) whose activation at runtime is conditional on a property value, where this property is required to have been specified in CAS configuration using kebab case. This is both true for properties that are owned by CAS as well as those that might be presented to the system via an external library or framework such as Spring Boot, etc. When possible, properties should be stored in
lower-case kebab format, such as cas.property-name=value.S ettings and properties that are controlled by the CAS platform directly always begin with the prefix cas. All other settings are controlled and provided to CAS via other underlying frameworks and may have their own schemas and syntax. BE CAREFUL with the distinction. Unrecognized properties are rejected by CAS and/or frameworks upon which CAS depends. This means if you somehow misspell a property definition or fail to adhere to the dot-notation syntax and such, your setting is entirely refused by CAS and likely the feature it controls will never be activated in the way you intend.
Validation
Configuration properties are automatically validated on CAS startup to report issues with configuration binding, specially if defined CAS settings cannot be recognized or validated by the configuration schema. The validation process is on by default and can be skipped on startup using a special system property SKIP_CONFIG_VALIDATION that should be set to true. Additional validation processes are also handled via Configuration Metadata and property migrations applied automatically on startup by Spring Boot and family.
Indexed Settings
CAS settings able to accept multiple values are typically documented with an index, such as cas.some.setting[0]=value. The index [0] is meant to be incremented by the adopter to allow for distinct multiple configuration blocks.
Kafka
Apache Kafka is an open-source message broker project developed by the Apache Software Foundation. The project aims to provide a unified, high-throughput, low-latency platform for handling real-time data feeds. It is, in its essence, a “massively scalable pub/sub message queue designed as a distributed transaction log”, making it highly valuable for enterprise infrastructures to process streaming data.
Support is enabled by including the following dependency in the final overlay:
1
2
3
4
5
<dependency>
<groupId>org.apereo.cas</groupId>
<artifactId>cas-server-support-configuration-cloud-kafka</artifactId>
<version>${cas.version}</version>
</dependency>
1
implementation "org.apereo.cas:cas-server-support-configuration-cloud-kafka:${project.'cas.version'}"
1
2
3
4
5
6
7
8
9
dependencyManagement {
imports {
mavenBom "org.apereo.cas:cas-server-support-bom:${project.'cas.version'}"
}
}
dependencies {
implementation "org.apereo.cas:cas-server-support-configuration-cloud-kafka"
}
Broadcast CAS configuration updates to other nodes in the cluster via Kafka.
The following settings and properties are available from the CAS configuration catalog:
spring.cloud.stream.kafka.binder.authorization-exception-retry-interval=
Time between retries after AuthorizationException is caught in the ListenerContainer; defalt is null which disables retries. For more info see: |
spring.cloud.stream.kafka.binder.auto-add-partitions=false
|
spring.cloud.stream.kafka.binder.auto-alter-topics=false
|
spring.cloud.stream.kafka.binder.auto-create-topics=true
|
spring.cloud.stream.kafka.binder.brokers=localhost
|
spring.cloud.stream.kafka.binder.certificate-store-directory=
When a certificate store location is given as classpath URL (classpath:), then the binder moves the resource from the classpath location inside the JAR to a location on the filesystem. If this value is set, then this location is used, otherwise, the certificate file is copied to the directory returned by java.io.tmpdir. |
spring.cloud.stream.kafka.binder.configuration=
Arbitrary kafka properties that apply to both producers and consumers. |
spring.cloud.stream.kafka.binder.consider-down-when-any-partition-has-no-leader=false
|
spring.cloud.stream.kafka.binder.consumer-properties=
Arbitrary kafka consumer properties. |
spring.cloud.stream.kafka.binder.header-mapper-bean-name=
The bean name of a custom header mapper to use instead of a |
spring.cloud.stream.kafka.binder.headers=
|
spring.cloud.stream.kafka.binder.health-timeout=60
Time to wait to get partition information in seconds; default 60. |
spring.cloud.stream.kafka.binder.jaas=
|
spring.cloud.stream.kafka.binder.min-partition-count=1
|
spring.cloud.stream.kafka.binder.producer-properties=
Arbitrary kafka producer properties. |
spring.cloud.stream.kafka.binder.replication-factor=-1
|
spring.cloud.stream.kafka.binder.required-acks=1
|
spring.cloud.stream.kafka.binder.transaction.producer.batch-timeout=
|
spring.cloud.stream.kafka.binder.transaction.producer.buffer-size=
|
spring.cloud.stream.kafka.binder.transaction.producer.compression-type=
|
spring.cloud.stream.kafka.binder.transaction.producer.configuration=
|
spring.cloud.stream.kafka.binder.transaction.producer.error-channel-enabled=
|
spring.cloud.stream.kafka.binder.transaction.producer.header-mode=
|
spring.cloud.stream.kafka.binder.transaction.producer.header-patterns=
|
spring.cloud.stream.kafka.binder.transaction.producer.message-key-expression=
|
spring.cloud.stream.kafka.binder.transaction.producer.partition-count=
|
spring.cloud.stream.kafka.binder.transaction.producer.partition-key-expression=
|
spring.cloud.stream.kafka.binder.transaction.producer.partition-key-extractor-name=
|
spring.cloud.stream.kafka.binder.transaction.producer.partition-selector-expression=
|
spring.cloud.stream.kafka.binder.transaction.producer.partition-selector-name=
|
spring.cloud.stream.kafka.binder.transaction.producer.required-groups=
|
spring.cloud.stream.kafka.binder.transaction.producer.sync=
|
spring.cloud.stream.kafka.binder.transaction.producer.topic=
|
spring.cloud.stream.kafka.binder.transaction.producer.use-native-encoding=
|
spring.cloud.stream.kafka.binder.transaction.transaction-id-prefix=
|
spring.cloud.stream.kafka.bindings=
|
Configuration Metadata
The collection of configuration properties listed in this section are automatically generated from the CAS source and components that contain the actual field definitions, types, descriptions, modules, etc. This metadata may not always be 100% accurate, or could be lacking details and sufficient explanations.
Be Selective
This section is meant as a guide only. Do NOT copy/paste the entire collection of settings into your CAS configuration; rather pick only the properties that you need. Do NOT enable settings unless you are certain of their purpose and do NOT copy settings into your configuration only to keep them as reference. All these ideas lead to upgrade headaches, maintenance nightmares and premature aging.
YAGNI
Note that for nearly ALL use cases, declaring and configuring properties listed here is sufficient. You should NOT have to explicitly massage a CAS XML/Java/etc configuration file to design an authentication handler, create attribute release policies, etc. CAS at runtime will auto-configure all required changes for you. If you are unsure about the meaning of a given CAS setting, do NOT turn it on without hesitation. Review the codebase or better yet, ask questions to clarify the intended behavior.
Naming Convention
Property names can be specified in very relaxed terms. For instance cas.someProperty, cas.some-property, cas.some_property are all valid names. While all forms are accepted by CAS, there are certain components (in CAS and other frameworks used) whose activation at runtime is conditional on a property value, where this property is required to have been specified in CAS configuration using kebab case. This is both true for properties that are owned by CAS as well as those that might be presented to the system via an external library or framework such as Spring Boot, etc. When possible, properties should be stored in
lower-case kebab format, such as cas.property-name=value.S ettings and properties that are controlled by the CAS platform directly always begin with the prefix cas. All other settings are controlled and provided to CAS via other underlying frameworks and may have their own schemas and syntax. BE CAREFUL with the distinction. Unrecognized properties are rejected by CAS and/or frameworks upon which CAS depends. This means if you somehow misspell a property definition or fail to adhere to the dot-notation syntax and such, your setting is entirely refused by CAS and likely the feature it controls will never be activated in the way you intend.
Validation
Configuration properties are automatically validated on CAS startup to report issues with configuration binding, specially if defined CAS settings cannot be recognized or validated by the configuration schema. The validation process is on by default and can be skipped on startup using a special system property SKIP_CONFIG_VALIDATION that should be set to true. Additional validation processes are also handled via Configuration Metadata and property migrations applied automatically on startup by Spring Boot and family.
Indexed Settings
CAS settings able to accept multiple values are typically documented with an index, such as cas.some.setting[0]=value. The index [0] is meant to be incremented by the adopter to allow for distinct multiple configuration blocks.